Expert Security Audit: Vibe-Informed Deployment Checklist (B2C SaaS)

A hybrid of structured security auditing, high-impact threat modeling, and practical developer guidance for consumer-facing SaaS platforms.

1. ANALYSIS PHASE — Full Codebase Review

Systematically review: authentication, data flow, API endpoints, environment variables
Document each finding with file and line number
Prioritize issues by risk impact (e.g., remote code execution > misconfiguration)
Identify areas where user data or authentication state crosses trust boundaries

Critical Focus Areas

2. CRITICAL SECURITY DOMAINS

Authentication & Authorization

Account Abuse & Bot Protection

Consumer SaaS platforms are frequent targets of automated abuse.

CAPTCHA or bot protection on login
CAPTCHA on signup flow
Rate limit login attempts
Rate limit password reset requests
Protection against credential stuffing
Temporary IP blocking after repeated failures
Device fingerprinting for suspicious behavior
Email domain abuse detection
Signup anomaly detection

Password & Credential Security

Passwords never stored in plaintext
Passwords hashed using bcrypt or argon2
Password hashing includes salt
Password reset tokens expire quickly (≤15 minutes)
Password reset tokens single-use
Breached password detection (HaveIBeenPwned or similar)
Password strength validation

Environment & Secrets Management

Environment variables never exposed to client code
Secrets stored only in server environment or secret manager
No secrets committed to repository
Deployment pipelines scrub secrets from logs
Production and development environments separated
API tokens scoped with least privilege

API Security

Rate limiting applied to every API route
Authentication required for sensitive endpoints
Request body schema validation
Server-side validation for all inputs
Request size limits enforced
Pagination required for large data sets
Authentication endpoints stricter rate limits

Input Validation & Data Sanitization

Validate all user inputs server-side
Sanitize all user input before storing
Encode outputs to prevent XSS
Parameterized database queries
Prevent command injection
Prevent path traversal
Reject malformed JSON or payloads

Database Security

Supabase Row Level Security (RLS) enabled on all tables
Database access restricted by role
Principle of least privilege applied
Sensitive columns encrypted where necessary
Query logs enabled
Direct database access not exposed publicly

Network & Transport Security

Cookie Security

Cookies set with HttpOnly
Cookies set with Secure
SameSite flag configured
Session cookies expire appropriately

CORS & Origin Security

CORS rules whitelist only trusted domains
No wildcard origins (*)
Credentials allowed only where necessary
Preflight requests validated

Error Handling & Information Leakage

Detailed error messages disabled in production
Stack traces never exposed to clients
Internal file paths hidden
Structured error logging implemented
User-facing errors sanitized

Dependency & Supply Chain Security

Run dependency audits every sprint (npm audit, etc.)
Dependency lockfiles committed
Outdated libraries reviewed regularly
Third-party packages vetted before use
Automated dependency alerts enabled

Logging & Monitoring

Privacy & Compliance (B2C)

Consumer platforms must support data privacy rights.

Email & Account Security

Email verification required for signup
Notify users of new device login
Notify users of password change
Prevent disposable email abuse
Secure email templates (no secrets)

Abuse Monitoring

Alert on unusual signup spikes
Alert on abnormal API usage
Alert on mass password reset attempts
Alert on suspicious geographic login patterns
Monitor traffic anomalies

3. PLANNING PHASE — Design Your Fix

For each vulnerability:

Describe the exact security risk
Show proof or attack vector (curl example, logs, etc.)
Outline remediation steps
Explain security implications of the fix

4. IMPLEMENTATION PHASE — Surgical Fixes

Only modify code relevant to security
Document before/after changes
Retest affected features
Verify no regressions introduced
Add additional hardening where appropriate

5. PRE-DEPLOY SECURITY GATE

Before every production deploy:

Run automated security audit
Verify rate limits active
Confirm authentication logging works
Confirm RLS policies enforced
Validate HTTPS enforcement
Run dependency vulnerability scan
Validate environment secret configuration

DO NOT

Make performance or styling changes
Commit unrelated refactors
Skip vulnerability analysis
Make changes without documenting the reason

After Each Fix

What vulnerability was addressed?
Why was the original code unsafe?
How does the fix mitigate the risk?
What additional hardening should be considered?

cosjef/security_audit_checklist.md

Select an option

No results found